- Home
- Honeypot Software
- Cowrie
Cowrie
What it is
Cowrie is a free, open-source SSH and Telnet honeypot for recording brute-force attempts and activity in attackers’ shell sessions. In its default mode, it imitates a UNIX system in Python with a fake filesystem, so commands do not execute on the real host. Proxy mode instead forwards sessions to another system while monitoring behavior. Cowrie records terminal sessions with timing information for later replay and saves files fetched through wget or curl, as well as uploads through SFTP or SCP. Its JSON logs can include logins, commands, downloads, TCP forwards, and session details. Output plugins connect it to services and tools such as Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, databases, Slack, Prometheus, and Amazon S3. An experimental LLM backend can generate shell responses while keeping conversation context within a session. Cowrie is self-hosted and can be installed with pip, Docker, or a Git checkout; the documentation lists Python 3.11+ and python-virtualenv as local requirements. The BSD-licensed project began in 2014 and is maintained by volunteers.
For and against
For
- Default shell uses a fake filesystem, not the real host
- Records sessions for later replay
- Captures downloads and SFTP or SCP uploads
- JSON logs include commands and session metadata
- Free and open source under a BSD license
Against
- Requires self-hosted deployment
- Local requirements include Python 3.11+ and python-virtualenv
- LLM backend is experimental
The verdict
Cowrie offers SSH and Telnet monitoring with session recording, file capture, and integrations for log output. Its default fake-shell mode keeps commands off the real host, but deployment and local requirements remain the operator’s responsibility.
Who it suits
Cowrie is intended for security researchers, CERTs, and defenders who want to monitor SSH and Telnet activity. Its self-hosted deployment and output plugins can suit teams that route honeypot logs into other systems.
Plans and prices
Cowrie
Free and open-source SSH and Telnet honeypot · BSD licensed
Read 2 Oct 2026 · cowrie.org
On the record
- Deployment
- Cowrie can be installed using pip, Docker or a Git checkout, and its documentation lists Python 3.11+ and python-virtualenv as local requirements.docs.cowrie.org · read 2 Oct 2026
- Emulated shell
- Its default shell mode emulates a UNIX system in Python with a fake filesystem and does not run attackers’ commands on the real host.cowrie.org · read 2 Oct 2026
- Integrations
- Output plugins include Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, Prometheus, Datadog and Amazon S3.cowrie.org · read 2 Oct 2026
- Intended users
- The project says it is used by security researchers, CERTs and defenders around the world.cowrie.org · read 2 Oct 2026
- License and history
- Cowrie is free and open source under a BSD license and began in 2014 as a fork of the Kippo honeypot.cowrie.org · read 2 Oct 2026
- LLM mode
- An experimental LLM backend can generate dynamic shell responses and maintain conversation context across a session.docs.cowrie.org · read 2 Oct 2026
- Logging
- Cowrie logs attacker activity as JSON, including logins, commands, downloads, TCP forwards and session metadata.cowrie.org · read 2 Oct 2026
- Malware capture
- Cowrie saves files fetched with wget or curl and files uploaded with SFTP or SCP for later inspection.docs.cowrie.org · read 2 Oct 2026
- Proxy mode
- Proxy mode forwards SSH and Telnet sessions to another system while monitoring attacker behavior.docs.cowrie.org · read 2 Oct 2026
- Security boundary
- The feature page says the emulated shell is safe to expose because commands run in a fake filesystem and do not touch the real host.cowrie.org · read 2 Oct 2026
- Session recording
- Cowrie records terminal sessions with timing information for later replay using its playlog utility.cowrie.org · read 2 Oct 2026
- Support
- The project links users to community Slack and Discord channels.cowrie.org · read 2 Oct 2026
- What it does
- Cowrie is a medium- to high-interaction SSH and Telnet honeypot designed to log brute-force attacks and attackers’ shell activity.docs.cowrie.org · read 2 Oct 2026
- Who maintains it
- Cowrie is maintained by volunteers, and the project credits creator and maintainer Michel Oosterhof.cowrie.org · read 2 Oct 2026
